1. Introduction

Critical Infrastructure Lending Oversight refers to the legal, regulatory, prudential, supervisory, and national-security controls governing loans and other financial arrangements used to develop, acquire, operate, maintain, or refinance infrastructure essential to the functioning of a country.

Critical infrastructure commonly includes:

Banking, payment systems, financial market infrastructure, and settlement systems.

Electricity generation, transmission, and distribution.

Oil, gas, and energy transportation networks.

Telecommunications, internet connectivity, and data centres.

Water supply, sanitation, and wastewater treatment.

Airports, ports, railways, highways, and strategic logistics networks.

Healthcare systems and emergency services.

Defence-related and other strategically important infrastructure.

Lending to these sectors raises questions beyond conventional repayment risk.

For example, if a commercial bank finances an electricity transmission operator, financial distress affecting the operator may endanger electricity supply. Conversely, if several banks have excessive exposure to the same infrastructure sector, disruption or regulatory change within that sector may threaten the stability of the financial system.

The central legal problem is therefore the interaction between private lending decisions, banking-system stability, continuity of essential services, and the state's national-security responsibilities.

Oversight is not one single statutory regime. It is a combination of banking regulation, infrastructure regulation, insolvency law, public law, investment screening, contract law, and—in some circumstances—national-security law.

2. Meaning and legal scope

The expression can be divided into four components.

A. Oversight of financial institutions

Banking regulators monitor whether lending to infrastructure operators creates unacceptable credit, liquidity, capital, governance, or concentration risks.

B. Oversight of infrastructure borrowers

Infrastructure regulators may separately supervise the borrower's licences, ownership, financial sustainability, operational standards, and continuity obligations.

C. Oversight of strategic control

Government investment-screening authorities may intervene where financing arrangements could lead to foreign control or influence over strategically important assets.

D. Oversight during financial distress

Courts, insolvency authorities, banking supervisors, and infrastructure regulators may all become involved where loan default threatens a critical service.

These are separate forms of oversight. A bank's approval of a loan does not establish that the financed infrastructure project satisfies all applicable licensing, competition, foreign-investment, or national-security requirements.

3. Principal legal frameworks

The precise rules depend on jurisdiction. The following comparison focuses on the European Union, Spain, the United Kingdom, the United States, and India.

A key distinction is that legislation identifying and protecting critical infrastructure does not necessarily authorize the infrastructure regulator to supervise ordinary banking credit decisions. Banking supervision generally remains with the competent financial regulator, subject to specific statutory exceptions.

4. Banking prudential oversight of critical infrastructure lending

4.1 Capital adequacy and credit-risk supervision

Banks financing critical infrastructure are normally required to evaluate the credit risks of such exposures and maintain sufficient regulatory capital against them.

Under the EU Capital Requirements Regulation, Regulation (EU) No 575/2013, as amended, banks must comply with requirements relating to:

Own funds and capital adequacy.

Credit-risk exposure measurement.

Large-exposure limitations.

Liquidity management.

Leverage and risk concentration.

Governance and supervisory reporting.

These requirements matter because infrastructure lending frequently involves large financial exposures, extended repayment periods, and dependence on project cash flows.

For example, consider a bank providing €800 million to a major electricity-transmission project. The supervisory questions include whether the borrower can service debt, whether projected regulated revenue is reliable, whether the bank is excessively concentrated in energy-related exposures, and whether failures in construction or operation could create losses.

Important distinction: Critical infrastructure status does not automatically produce a preferential regulatory capital treatment.

Under the CRR, certain qualifying infrastructure exposures can receive preferential treatment within the relevant credit-risk framework, but eligibility is subject to specific legal conditions. A project is not entitled to favourable treatment merely because it supplies an essential public service.

4.2 Large-exposure restrictions

Article 395 CRR provides a principal EU rule under which an institution's exposure to a client or group of connected clients generally must not exceed 25% of its Tier 1 capital, subject to applicable qualifications and exemptions.

This rule can significantly affect infrastructure financing because individual projects may require funding beyond the lending capacity of a single regulated bank.

Consequently, financing may be structured through syndicated loans, institutional investors, bond issuance, development banks, or combinations of lenders.

However, syndication does not eliminate the underlying project's risk. Each participating bank must still assess its own exposure and comply with applicable prudential rules.

4.3 Supervisory review and evaluation

Under the EU supervisory review and evaluation process (SREP), competent authorities examine the risk profile, governance, capital position, and liquidity adequacy of supervised institutions.

The European Central Bank supervises significant institutions within the Single Supervisory Mechanism, while national competent authorities perform relevant functions concerning less significant institutions, subject to the applicable supervisory structure.

Infrastructure lending can generate supervisory concern where:

A bank is highly exposed to one energy market.

Loan repayments depend on politically sensitive tariffs.

Several infrastructure borrowers depend on a single public authority.

Loan collateral has little alternative commercial use.

Projects face significant construction, environmental, or licensing risks.

Banks have not adequately assessed potential interdependencies between essential services.

Legal consequence: A supervisor may require additional capital, stronger risk management, exposure reductions, or other corrective action where justified under the relevant supervisory powers.

Case Law 1: Peter Paul and Others v Federal Republic of Germany

Court of Justice of the European Union · Case C-222/02 · Judgment of 12 October 2004

Facts: Depositors who suffered losses following the failure of a credit institution argued that German banking supervisors had inadequately fulfilled their supervisory responsibilities. They sought compensation based on alleged failures to supervise.

Legal issue: Did EU banking-supervision directives confer individual rights on depositors to demand damages from the state for defective banking supervision?

Judgment: The Court held, in the circumstances and under the directives at issue, that EU law did not require national law to give depositors an individual right to damages for inadequate prudential supervision where the applicable deposit-guarantee protections were ensured.

Legal principle: Prudential supervision is primarily directed toward protecting the banking system and collective interests, without necessarily creating an individual compensatory claim for each person adversely affected by a supervisory failure.

Application to infrastructure lending: If a supervisor fails to identify excessive bank exposure to critical infrastructure, resulting losses do not automatically give borrowers, investors, or affected service users a right to compensation from the regulator.

That question depends on the applicable statute, the legal duties concerned, national liability rules, and any separately applicable EU-law remedies.

Limitation: This case does not give banking supervisors universal immunity from legal accountability, and it does not concern infrastructure lending specifically.

5. Oversight of project finance and infrastructure loan structures

Infrastructure finance is often based on limited-recourse or non-recourse project-financing structures, where loan repayment primarily depends on revenue generated by the financed asset rather than the general assets of its sponsors.

Examples include toll-road concessions, renewable-energy projects, gas terminals, telecommunications networks, ports, and airport facilities.

5.1 Structural oversight

A banking supervisor ordinarily expects appropriate assessment of several interconnected risks.

5.2 Loan covenants and ongoing monitoring

Lenders may use contractual controls such as debt-service coverage ratios, information covenants, restricted distributions, reserve accounts, financial reporting obligations, and default provisions.

For critical infrastructure, the documentation may also address changes in ownership or control, licence termination, regulatory investigations, cybersecurity obligations, and maintenance of operational capability.

A loan agreement may give lenders step-in rights or enforcement rights, but their exercise can be limited by concession law, sectoral regulation, insolvency rules, or national-security restrictions.

A creditor's contractual enforcement right should therefore never be assumed to override a statutory requirement to maintain continuity of an essential service.

Case Law 2: United States v Winstar Corp.

Supreme Court of the United States · 518 U.S. 839 (1996)

Facts: In the American savings-and-loan crisis, certain institutions entered into arrangements with federal regulatory agencies concerning the accounting treatment of supervisory goodwill. Subsequent legislative changes prevented the agreed treatment, giving rise to contractual claims.

Legal issue: Whether the United States could incur contractual liability when later regulatory changes frustrated commitments previously made in agreements with financial institutions.

Judgment: The Supreme Court upheld liability on the contractual claims, rejecting the proposition that the government's regulatory sovereignty automatically defeated its obligations under the agreements.

Legal principle: The state may retain sovereign regulatory authority while also bearing contractual liability for particular commitments it has undertaken.

Application to critical infrastructure: Where government entities give contractual undertakings concerning infrastructure financing, later regulatory changes may raise questions of contractual risk allocation and liability.

The decision is particularly relevant to projects relying on public-sector guarantees or government-backed financial arrangements.

Limitation: Winstar does not establish that infrastructure borrowers have a general right to protection from regulatory changes. Its outcome depended on the particular contracts and statutory circumstances.

6. Spain: Critical infrastructure lending and national-security oversight

Spain is particularly important because critical infrastructure financing can engage several distinct regulatory systems simultaneously.

6.1 Law 8/2011 on Critical Infrastructure Protection

Spain's Law 8/2011 of 28 April establishes measures for the protection of critical infrastructure.

Royal Decree 704/2011 develops its implementation.

The framework encompasses infrastructure essential to important social functions, including relevant activities in the financial, energy, telecommunications, and transportation sectors.

The system distinguishes between strategic infrastructure and infrastructure formally designated as critical. Not every important asset automatically becomes a legally designated critical infrastructure asset.

Critical infrastructure designation

The designation process is conducted through the competent public authorities under the applicable legal framework.

The designation of an infrastructure operator can produce obligations involving protective planning, security coordination, and cooperation with the relevant authorities.

For lending oversight, the following distinction is crucial:

Critical infrastructure designation primarily affects the obligations attached to the infrastructure and its operator; it does not, by itself, transfer responsibility for supervising bank lending from financial regulators to the infrastructure-protection authorities.

6.2 Spanish banking supervision

Spanish banking supervision is principally governed by Law 10/2014 of 26 June on the organisation, supervision and solvency of credit institutions, its implementing legislation, and directly applicable EU rules.

The Banco de España exercises banking supervisory responsibilities within the applicable allocation of authority under the SSM, alongside the ECB.

A bank lending to a Spanish critical infrastructure operator must address applicable prudential requirements, even where the infrastructure also falls within a separate state-security framework.

The relevant distinction is between:

The bank's risk exposure, supervised under banking law.

The operator's infrastructure obligations, supervised under the relevant critical-infrastructure and sectoral law.

The ownership or control consequences of the financing, which may engage foreign-investment screening.

6.3 Foreign investment screening

Spain's foreign-investment framework, including Article 7 bis of Law 19/2003 and related implementing rules, can require prior authorisation for certain foreign investments involving sensitive sectors and strategically important assets.

The framework must be assessed in light of amendments, investor characteristics, applicable thresholds, and the nature of the acquisition.

Critical infrastructure financing becomes particularly sensitive where loan arrangements include:

Conversion rights capable of resulting in ownership or control.

Share pledges over strategically important infrastructure operators.

Enforcement arrangements leading to a change in control.

Restructurings involving foreign strategic investors.

Acquisition financing that forms part of a transaction subject to investment screening.

A simple credit agreement does not automatically constitute a foreign direct investment requiring authorisation. The legal character and effects of the arrangement are decisive.

Case Law 3: Xella Magyarország Építőanyagipari Kft. v Innovációs és Technológiai Miniszter

Court of Justice of the European Union · Case C-106/22 · Judgment of 13 July 2023

Facts: A Hungarian company sought to acquire another Hungarian company active in extracting construction materials. Hungarian authorities prohibited the transaction under national foreign-investment screening rules, invoking strategic supply concerns. The acquiring company was controlled through a corporate structure involving a non-EU investor.

Legal issue: Whether the prohibition complied with EU law, particularly freedom of establishment, and how the EU foreign direct investment screening framework applied to the transaction.

Judgment: The Court held that Regulation (EU) 2019/452 did not govern the investment merely because the EU-incorporated acquirer was ultimately controlled by a third-country undertaking. The prohibition also had to satisfy the requirements of EU fundamental freedoms. The reasons presented did not justify the restriction under the applicable test.

Legal principles:

Investment-screening restrictions must operate within the boundaries of EU law.

National-security and public-security interests do not eliminate the need to assess the legal justification for a restriction.

Corporate nationality, beneficial ownership, the transaction's structure, and the applicable regulatory framework matter.

Application to Spain: If a creditor or investor acquires control over a Spanish critical infrastructure undertaking through a financing-related transaction, authorities must determine whether screening applies and whether any restriction is justified under relevant national and EU law.

The decision is especially relevant to acquisition finance, enforcement over pledged shares, and debt-to-equity restructuring.

Limitation: Xella was an investment-screening case, not a judicial ruling establishing a general rule for loan approvals.

Case Law 4: Commission v Spain

Court of Justice of the European Union · Case C-463/00 · Judgment of 13 May 2003

Facts: Spain maintained provisions allowing special state approval of certain decisions involving privatised undertakings operating in strategically important sectors.

Legal issue: Whether those arrangements unlawfully restricted free movement of capital under EU law.

Judgment: The Court found that the contested special powers were incompatible with EU free-movement requirements.

Legal principle: The state's interest in protecting strategic economic sectors does not provide unlimited authority to restrict private investment or corporate decisions.

Application to critical infrastructure lending: If state controls affect a lender's ability to acquire, restructure, or enforce security over a strategic operator, those controls must possess an appropriate legal basis and satisfy applicable EU requirements.

Spain can legitimately maintain national-security and infrastructure-protection measures, but their design and operation must comply with relevant legal limits.

This decision is particularly useful for examining whether the restriction imposed on financing or ownership arrangements goes further than justified by the public interest.

7. United Kingdom: Lending oversight and protection of strategic infrastructure

The United Kingdom employs a combination of prudential supervision, financial regulation, sector-specific legislation, insolvency procedures, and national-security investment screening.

The main financial regulators include the Prudential Regulation Authority and Financial Conduct Authority, acting within their respective statutory responsibilities.

7.1 Prudential lending supervision

The PRA monitors the safety and soundness of regulated firms, including the quality of lending portfolios, capital adequacy, liquidity resilience, and governance.

Large loans to energy companies, utilities, telecom operators, or transport infrastructure may raise concerns involving sector concentrations and correlated risks.

7.2 National Security and Investment Act 2021

Under the National Security and Investment Act 2021, certain acquisitions of control over entities active in specified sensitive areas are subject to mandatory notification, while other qualifying acquisitions may be called in for national-security assessment.

Relevant areas can include energy, communications, data infrastructure, and other specified sectors.

For lenders, the important point is that ordinary lending and a qualifying acquisition of control are different legal events.

The creation or enforcement of security, debt conversion, or other transactions may need separate analysis when they confer statutory control rights.

Not every charge, pledge, or loan covenant activates the legislation.

7.3 Special administration and continuity

Certain regulated infrastructure sectors have special administration arrangements designed to preserve essential public services or achieve sector-specific statutory objectives.

Such arrangements can affect the ordinary enforcement rights of creditors.

Therefore, a bank may have valid security over assets without possessing unrestricted power to sell, disconnect, or discontinue those assets.

Case Law 5: R (British Bankers' Association) v Financial Services Authority

High Court of England and Wales · [2011] EWHC 999 (Admin)

Facts: The British Bankers' Association challenged regulatory measures and complaint-handling guidance introduced by the Financial Services Authority concerning payment protection insurance.

Legal issue: Whether the regulator acted lawfully in establishing and applying standards addressing systemic consumer-protection failures.

Judgment: The High Court dismissed the challenge.

Legal principle: A financial regulator can lawfully impose standards within its statutory authority, subject to the applicable principles of administrative law.

Application to critical infrastructure lending: Although the case concerned consumer insurance rather than infrastructure credit, it illustrates how financial-sector regulatory interventions can be challenged through judicial review.

It is relevant to assessing the legality of regulatory rules and corrective measures affecting banks.

The case should not be cited as establishing a specific UK regulatory duty to protect infrastructure borrowers.

8. India: RBI lending oversight and infrastructure protection

In India, infrastructure lending involves an interaction between the Reserve Bank of India's prudential framework, sector-specific legislation, public contracting, debt recovery, and insolvency law.

8.1 RBI's role

The RBI supervises regulated banks under the Banking Regulation Act 1949, the Reserve Bank of India Act 1934, and other applicable legal instruments.

Its responsibilities can include regulating lending practices, assessing credit risk, setting prudential norms, inspecting banks, and taking corrective supervisory action.

Infrastructure loans may require particular attention to:

Project appraisal and viability.

Regulatory permissions and concessions.

Construction milestones.

Sources of project revenue.

Repayment and refinancing risks.

Asset classification and provisioning.

Sectoral concentration.

Connected lending and governance.

The RBI's project-finance directions and other prudential instructions must be checked in the versions applicable to the institution and relevant financing date. Not all categories of regulated financial institutions are necessarily governed by identical requirements.

8.2 Infrastructure lending and insolvency

The Insolvency and Bankruptcy Code 2016 is relevant when an infrastructure borrower becomes financially distressed.

The insolvency process generally aims to facilitate resolution of corporate insolvency, subject to statutory requirements and judicial supervision.

However, projects involving public utilities, regulated licences, concessions, or essential public services can present additional complications.

For example, financial creditors may wish to transfer ownership of an insolvent infrastructure undertaking, while the sectoral regulator may require approval of a transfer of the operating licence.

The corporate insolvency process does not automatically abolish every independent regulatory requirement governing the business.

Case Law 6: Swiss Ribbons Pvt. Ltd. v Union of India

Supreme Court of India · (2019) 4 SCC 17

Facts: Constitutional challenges were brought against significant provisions of the Insolvency and Bankruptcy Code.

Legal issue: Whether the IBC's framework, including distinctions between financial and operational creditors, complied with constitutional requirements.

Judgment: The Supreme Court substantially upheld the constitutional validity of the IBC framework.

Legal principle: The IBC's central objectives include timely insolvency resolution, value maximisation, and balancing the interests of stakeholders.

Application to critical infrastructure lending: Infrastructure lenders can exercise statutory rights within the insolvency process, but their interests must be considered within the collective resolution framework rather than through unrestricted individual enforcement.

The decision demonstrates that insolvency law serves broader economic purposes beyond the immediate recovery claims of individual creditors.

Case Law 7: Committee of Creditors of Essar Steel India Ltd. v Satish Kumar Gupta

Supreme Court of India · (2020) 8 SCC 531

Facts: Disputes arose concerning approval and distribution under an insolvency resolution plan for Essar Steel.

Legal issue: The extent of judicial interference with the commercial decisions of the committee of creditors.

Judgment: The Supreme Court emphasised the commercial wisdom of the committee of creditors, while recognising the statutory framework for judicial review of resolution plans.

Legal principle: Courts and insolvency tribunals generally do not substitute their own commercial assessment for that of the committee of creditors when decisions fall within the applicable statutory framework.

Application to infrastructure lending: If a consortium of banks finances a critical infrastructure operator that enters insolvency, the creditors' committee may have considerable authority over the commercial resolution strategy.

But its decisions remain subject to the IBC and other applicable legal requirements.

Important qualification: Essar Steel does not establish that creditor commercial wisdom automatically overrides infrastructure licensing requirements or national-security restrictions.

Case Law 8: Mardia Chemicals Ltd. v Union of India

Supreme Court of India · (2004) 4 SCC 311

Facts: Borrowers challenged provisions of the Securitisation and Reconstruction of Financial Assets and Enforcement of Security Interest Act 2002 (SARFAESI).

Legal issue: Whether the statutory enforcement framework for secured creditors complied with constitutional and legal safeguards.

Judgment: The Supreme Court broadly upheld the SARFAESI framework but struck down the then-existing requirement under Section 17(2) requiring a borrower to deposit 75% of the claimed amount as a precondition to pursuing the specified remedy.

Legal principle: Strong enforcement rights for secured creditors may be constitutionally permissible, but statutory enforcement mechanisms remain subject to judicial safeguards.

Application to infrastructure: Lenders with security over infrastructure assets may be able to employ SARFAESI remedies when statutory conditions are met.

Nevertheless, the availability and exercise of those remedies can be affected by the nature of the asset, the security interest, sector-specific restrictions, and applicable statutory exclusions.

A secured lender does not gain an automatic right to disregard public utility obligations merely because the financed undertaking defaults.

Case Law 9: Reserve Bank of India v Jayantilal N. Mistry

Supreme Court of India · (2016) 3 SCC 525

Facts: Disputes arose concerning requests for information held by the RBI in connection with banking regulation and supervision.

Legal issue: Whether the RBI could withhold requested supervisory information by relying on claims concerning fiduciary relationships and confidentiality.

Judgment: The Supreme Court rejected the broad confidentiality position advanced by the RBI in the circumstances before it and emphasised the regulator's statutory role and public accountability.

Legal principle: Banking regulation involves public responsibilities, and supervisory confidentiality claims must be assessed under the governing legal framework rather than assumed to be absolute.

Application to infrastructure lending: This case is relevant to disputes involving the transparency of regulatory supervision, particularly where systemic lending exposures could have wider public consequences.

It does not establish unlimited public access to all confidential financial information. Any disclosure request remains governed by the applicable statutory rules, exemptions, and subsequent legal developments.

9. United States: Banking oversight and national-security considerations

American infrastructure lending is supervised through several overlapping regulatory systems.

These may include the Federal Reserve, Office of the Comptroller of the Currency, Federal Deposit Insurance Corporation, and relevant state banking regulators, depending on the institution concerned.

9.1 Safety-and-soundness supervision

Banks making significant infrastructure loans must manage credit exposure and comply with applicable capital, concentration, underwriting, and risk-management requirements.

Federal banking agencies may examine matters such as the quality of the loan portfolio, adequacy of underwriting, credit administration, collateral values, management oversight, and problem-loan recognition.

9.2 National-security review

Section 721 of the Defense Production Act, as amended, provides the statutory foundation for review of certain covered investments by the Committee on Foreign Investment in the United States (CFIUS).

CFIUS is relevant where a foreign investor's involvement in an infrastructure undertaking gives rise to a covered transaction.

Certain transactions involving businesses connected to critical technologies, critical infrastructure, or sensitive personal data can fall within the applicable framework.

A straightforward loan is not necessarily a covered CFIUS transaction. The structure of investment rights, control, contingent rights, and enforcement can matter.

Case Law 10: Ralls Corporation v Committee on Foreign Investment in the United States

US Court of Appeals for the District of Columbia Circuit · 758 F.3d 296 (D.C. Cir. 2014)

Facts: Ralls Corporation, owned by Chinese nationals, acquired wind-farm project companies in Oregon. The President ordered divestment on national-security grounds.

Legal issue: Whether the affected investor possessed procedural due-process rights when the government issued a divestment order following national-security review.

Judgment: The Court of Appeals recognised that Ralls had a protected property interest and that the procedures afforded were constitutionally inadequate in material respects.

Legal principle: National-security investment-screening decisions may be subject to constitutionally required procedural safeguards, even where executive powers are broad.

Application to infrastructure lending: If a financing or restructuring transaction results in foreign acquisition of strategically important infrastructure, national-security review may affect ownership, security enforcement, and transaction completion.

The case illustrates the procedural dimension of such oversight.

Limitation: It involved an acquisition of wind-farm businesses, not a conventional bank loan.

Case Law 11: Camp v Pitts

Supreme Court of the United States · 411 U.S. 138 (1973)

Facts: An applicant challenged a federal banking authority's denial of an application for a new national bank charter.

Legal issue: What standard and administrative record should govern judicial review of the regulator's decision.

Judgment: The Supreme Court explained that judicial review under the applicable administrative-law framework was based on whether the agency's decision was arbitrary, capricious, an abuse of discretion, or otherwise not in accordance with law.

Legal principle: Banking regulators exercise substantial administrative discretion, but that discretion is subject to legally defined standards of review.

Application to lending oversight: Where supervisory decisions concerning banking activities are reviewable, courts examine the legal basis and decision-making process under the applicable administrative-law framework.

The case does not require regulators to approve infrastructure lending or to replace a bank's own credit judgment with the regulator's.

10. Infrastructure interdependencies and systemic risk

One of the most important features of critical infrastructure lending is the interdependence between essential sectors.

Illustrative chain of infrastructure-related financial and operational risk

Electricity transmission disruption

Operational failure or loss of service

Telecom networks

Depend on reliable power

Banking operations

Depend on electricity and connectivity

Financial consequences

Cash-flow disruption, loan repayment stress, liquidity pressure, and possible credit losses

Illustrative risk pathways, not an assertion that every infrastructure disruption necessarily causes banking instability.

10.1 Direct credit risk

An infrastructure borrower can default because its assets stop producing revenue.

10.2 Indirect or correlated risk

Several borrowers may simultaneously experience financial problems because they depend on the same energy network, telecom provider, government purchaser, or logistics system.

10.3 Operational dependencies

Banks themselves rely on critical infrastructure to operate branches, electronic payments, data centres, and transaction-processing systems.

Consequently, an event affecting energy or telecommunications infrastructure may simultaneously disrupt bank operations and impair borrowers' ability to repay loans.

10.4 Concentration and contagion

Where several lenders finance the same sector or interconnected group of projects, adverse developments may generate correlated losses.

The prudential importance of such events depends on the magnitude of the exposures, the degree of correlation, the financial position of the lenders, and available risk mitigants.

11. EU operational resilience: DORA and NIS2

Two important EU legislative instruments illustrate the distinction between banking resilience and critical infrastructure security.

A. Digital Operational Resilience Act

Regulation (EU) 2022/2554, commonly called DORA, has applied since 17 January 2025.

It imposes harmonised digital operational resilience obligations on covered financial entities, including requirements concerning ICT risk management, incident reporting, operational resilience testing, and third-party ICT risk management.

DORA is relevant to infrastructure lending in two ways.

First, banks must manage their own digital operational risks, including relevant dependencies on external service providers.

Second, due diligence concerning an infrastructure borrower may need to assess the borrower's cyber resilience, particularly where operational disruptions could materially impair repayment.

However, DORA does not automatically impose its entire framework directly on every electricity or telecommunications company simply because that company has borrowed from a bank.

B. NIS2 Directive

Directive (EU) 2022/2555 establishes an EU cybersecurity framework covering specified essential and important entities across relevant sectors.

It addresses cybersecurity risk management, incident reporting, and supervisory and enforcement arrangements, subject to its scope, national implementation, and applicable sector-specific rules.

For critical infrastructure lending, NIS2-related compliance problems may create material operational, financial, or regulatory risk for borrowers.

C. Combined implications

Banks may need to understand whether a project operator is subject to sector-specific cybersecurity requirements, whether its continuity arrangements are credible, and whether a significant incident could disrupt projected revenue.

But there is a legal distinction between the infrastructure operator's statutory cybersecurity duties and the bank's responsibility to assess the credit consequences of those risks.

12. State aid, government guarantees, and public financial support

Critical infrastructure projects frequently involve state guarantees, public-private partnerships, subsidised credit, development-bank financing, or government payment undertakings.

These arrangements create a separate oversight question: whether public financial support complies with applicable competition, budgetary, public-procurement, and state-aid rules.

Within the European Union, Articles 107–109 TFEU are central to the state-aid framework.

Public support for infrastructure is not necessarily unlawful. Its legality depends on the structure of the measure, the economic advantage conferred, whether it qualifies as state aid, and any applicable exemption or approval framework.

Case Law 12: Kotnik and Others

Court of Justice of the European Union · Case C-526/14 · Judgment of 19 July 2016

Facts: The case arose from measures concerning the restructuring of Slovenian banks and burden-sharing requirements linked to state aid.

Legal issue: The legal status of the European Commission's banking communication and its compatibility with EU law, particularly in relation to burden sharing by shareholders and subordinated creditors.

Judgment: The Court clarified the status and effects of the Commission's state-aid guidance and examined the compatibility of the relevant burden-sharing approach with EU law.

Legal principle: Public financial support for banks may be subject to EU state-aid conditions, and creditor and shareholder interests must be analysed within that framework.

Application: If extensive infrastructure lending losses endanger a bank and public recapitalisation is proposed, state-aid rules may affect the design of the rescue.

This is distinct from a public grant or guarantee provided directly to an infrastructure project.

Case Law 13: Ledra Advertising Ltd and Others v European Commission and ECB

Court of Justice of the European Union · Joined Cases C-8/15 P to C-10/15 P · Judgment of 20 September 2016

Facts: Depositors challenged aspects of financial assistance arrangements concerning Cyprus and the restructuring of its banking sector.

Legal issue: Whether the conduct of EU institutions in connection with the assistance arrangements could give rise to non-contractual liability for alleged breaches of EU law.

Judgment: The Court recognised that the Commission had to ensure consistency with EU law in the relevant circumstances but found that the conditions for damages were not established in the proceedings.

Legal principle: Financial-crisis interventions are not categorically immune from review for compliance with EU law.

Application: Government or supranational intervention affecting financial institutions heavily exposed to infrastructure remains subject to applicable legal and institutional constraints.

The case does not itself govern ordinary infrastructure project finance.

13. Oversight during default, restructuring, and enforcement

A critical infrastructure loan presents special legal challenges once the borrower becomes unable to repay.

The following framework illustrates how the interests of lenders, regulators, infrastructure operators, and the public may interact.

Example: Default by a telecommunications infrastructure operator

Assume a Spanish telecommunications infrastructure company operates strategically important transmission facilities and owes €600 million to a syndicate of lenders.

The company defaults on its repayments. Its lenders hold pledges over shares, security over certain assets, and contractual rights to enforce on specified default events.

Several legal questions arise.

First, banking oversight: The relevant banking supervisors assess the exposures and risks faced by regulated lenders, rather than automatically deciding who should own or operate the telecommunications infrastructure.

Second, infrastructure regulation: The operator remains subject to applicable telecom and critical infrastructure requirements, including any relevant operational and continuity obligations.

Third, insolvency law: The lenders' enforcement rights may be affected by restructuring proceedings, insolvency stays, creditor-ranking rules, and statutory protections.

Fourth, foreign investment screening: If enforcement leads to a qualifying acquisition by a foreign investor, the transaction may require assessment under applicable Spanish investment-screening law.

Fifth, EU law: Any state restriction affecting investment or corporate control must comply with the relevant EU legal framework, including any applicable national-security exceptions and proportionality requirements.

The resulting legal position is therefore not simply that secured creditors can take unrestricted control of the infrastructure on default.

Equally, critical infrastructure designation does not automatically extinguish valid security rights or eliminate the borrower's debt.

The outcome depends on the interaction of the financing documents, relevant security law, insolvency law, sectoral regulatory obligations, and any applicable investment controls.

14. Legal principles derived from the case law

The cases discussed above establish or illustrate several principles relevant to critical infrastructure lending oversight.

These cases should not be presented as a single unified body of case law specifically on critical infrastructure lending. Rather, they address the separate legal doctrines that become relevant when such lending produces regulatory conflicts.

15. A model framework for effective lending oversight

A well-designed system of critical infrastructure lending oversight should coordinate five distinct legal objectives.

1. Banking stability

Capital adequacy, credit underwriting, concentration limits, liquidity, and supervisory intervention.

2. Infrastructure continuity

Protection of essential services, operating licences, resilience, security, and emergency planning.

3. Creditor rights and due process

Enforceable loan contracts, lawful security arrangements, fair procedures, and judicial remedies.

4. National security and strategic control

Review of qualifying foreign investment, ownership transfers, sensitive assets, and control rights.

5. Systemic interdependency management

Assessment of interconnected electricity, telecom, payment, transport, and financial-system risks.

A possible governance model is to require each institution to exercise its own statutory powers while maintaining channels for supervisory cooperation where the law permits.

For example, the banking supervisor can examine whether a lender has appropriately accounted for potential infrastructure disruptions, while the sectoral regulator evaluates the operator's resilience and service-continuity obligations.

Where a national-security authority must approve a change of control, the financing parties can make completion or enforcement conditional upon obtaining legally required approvals.

Such coordination reduces the risk that each authority supervises only its own sector without recognising systemic interdependencies.

16. Important legal distinctions

Several propositions are particularly important in a legal opinion, academic dissertation, regulatory submission, or court pleading.

1. Critical infrastructure designation is not equivalent to state ownership. Privately owned infrastructure may be designated critical without the state acquiring ownership of the asset.

2. Critical infrastructure designation is not an automatic lending prohibition. Ordinary banking and project-finance transactions may remain permissible, subject to applicable legal requirements.

3. Lending oversight is different from investment screening. Providing credit, enforcing security, and obtaining corporate control may constitute different legal events and require separate analysis.

4. National security is not an unrestricted exception to ordinary law. Government restrictions must comply with the applicable legal framework and relevant procedural and substantive requirements.

5. Banking supervisory authority does not automatically include infrastructure operating authority. The regulator responsible for bank solvency may not be the authority entitled to approve transfer of a port concession or telecom licence.

6. Creditor enforcement rights may coexist with public-service obligations. A valid debt and security interest do not necessarily permit immediate cessation of essential services.

7. Systemic importance must be distinguished from borrower creditworthiness. An infrastructure project can be indispensable to the economy yet still be financially unsustainable.

17. Conclusion

Critical Infrastructure Lending Oversight sits at the intersection of banking law, national-security law, infrastructure regulation, public administration, contractual rights, and insolvency law.

The fundamental purpose is to prevent financing decisions and financial distress from generating unacceptable risks either to regulated lenders or to the essential services on which society depends.

The principal case-law lessons are that banking regulators possess important supervisory powers but remain subject to legal constraints; strategic investment restrictions require a valid statutory and legal justification; creditor enforcement remains governed by contract, security, and insolvency law; and the public importance of an infrastructure asset does not automatically resolve disputes over ownership, lending, or regulatory jurisdiction.

For Spain in particular, the most useful starting authorities are Law 8/2011, Law 10/2014, the EU CRR and CRD framework, Article 7 bis of Law 19/2003, and the judgments in Xella and Commission v Spain.

Those authorities provide the foundation for analysing how banking exposure, infrastructure designation, foreign ownership, and public-security considerations interact.

Research qualification: This is a comparative legal analysis, not a jurisdiction-specific legal opinion. The cases cited are established authorities, but live legislative amendments, current consolidated statutory text, and subsequent judicial treatment have not been independently verified in this response. For formal legal use, the relevant provisions and judgments should be checked against official court databases and legislation in force on the relevant transaction date.